Mjag dropper: Using decoy documents to drop RATs

**Executive summary:** This report analyzes the Mjag dropper (a .NET dropper obfuscated with SmartAssembly) which delivers the Punisher RAT; it documents installation and persistence behaviors, process injection (and a noted overlay injection issue), credential-stealing and keylogging modules, USB spreading, anti-analysis checks, the hardcoded C2 and protocol delimiters, and provides IOCs (MD5, filename, download URL, C2).